CN118301022A

CN118301022A - Method and device for detecting overrun of session number

Info

Publication number: CN118301022A
Application number: CN202211687048.5A
Authority: CN
Inventors: 翟周
Original assignee: Ruijie Networks Co Ltd
Current assignee: Ruijie Networks Co Ltd
Priority date: 2022-12-27
Filing date: 2022-12-27
Publication date: 2024-07-05

Abstract

The invention discloses a method and a device for detecting the overrun of the number of sessions, which are used for improving the accuracy of the overrun detection of the number of sessions. The method comprises the following steps: receiving a conversation number overrun detection instruction, and acquiring conversation data of a preset time period according to the conversation number overrun detection instruction; determining a target abnormal time meeting screening conditions according to the session data of the preset time period, and determining a session number threshold according to the abnormal session number corresponding to the target abnormal time; the screening condition is used for selecting the abnormal time with the highest confidence from the abnormal time corresponding to the abnormal session data in the preset time period; determining an abnormal duration time period when the number of the sessions exceeds the session number threshold in the preset time period according to the session number threshold; and determining whether the session number exceeds the limit according to the abnormal duration time period.

Description

Method and device for detecting overrun of session number

Technical Field

The present invention relates to the field of communications, and in particular, to a method and apparatus for detecting overrun of session number.

Background

With the continuous development of technology and the continuous improvement of technology, more and more devices are networked in the user home, and a large number of session numbers can be established by the devices, and if the session number resources of a network operator are exhausted, the subsequent newly-built connection can fail randomly, so that the internet surfing experience of the user is affected. Therefore, how to accurately detect the overrun of the number of sessions becomes a problem to be solved.

Currently, in the related art, when detecting the overrun of the session number, the following schemes are generally adopted:

Scheme 1: and determining a session number threshold by adopting a clustering algorithm, and further determining whether the problem of overrun of the session number exists or not based on the session number threshold.

However, when the scheme 1 is adopted, the clustering algorithm randomly selects the clustering center, that is, the clustering result of each time may be different, so that abnormal time when the number of sessions exceeds the limit may be judged as normal time, and the abnormal number of sessions is judged to be wrong, so that positioning dislocation of reasons causing network blocking is caused, and the internet surfing experience of a user is affected.

Scheme 2: and adopting a manual pre-estimated session number threshold value to further determine whether the problem of overrun of the session number exists or not based on the session number threshold value.

However, when scheme 2 is adopted, the limits of the session numbers are different in different regions and different network operators, and the operators generally cannot inform clients of the broadband session number limit, but the artificially set session number threshold is inaccurate, and different devices are different, so that the possibility of error estimation of the session number threshold exists, and the positioning dislocation of the cause causing network stuck may be caused.

In summary, in the related art, there is a problem that the threshold of the number of sessions cannot be accurately determined when detecting the overrun of the number of sessions.

Disclosure of Invention

The embodiment of the invention provides a method and a device for detecting the overrun of a conversation number, which are used for improving the accuracy of determining a conversation number threshold value, thereby improving the accuracy of detecting the overrun of the conversation number.

In a first aspect, a method for detecting overrun of session number is provided, the method comprising:

receiving a conversation number overrun detection instruction, and acquiring conversation data of a preset time period according to the conversation number overrun detection instruction;

Determining a target abnormal time meeting screening conditions according to the session data of the preset time period, and determining a session number threshold according to the abnormal session number corresponding to the target abnormal time; the screening condition is used for selecting the abnormal time with the highest confidence from the abnormal time corresponding to the abnormal session data in the preset time period;

Determining an abnormal duration time period when the number of the sessions exceeds the session number threshold in the preset time period according to the session number threshold;

and determining whether the session number exceeds the limit according to the abnormal duration time period.

In one possible implementation manner, determining the target abnormal moment meeting the screening condition according to the session data of the preset time period includes:

Detecting session data in the preset time period by adopting at least two abnormality detection modes, and respectively obtaining abnormal moments corresponding to at least one abnormal session data corresponding to each abnormality detection mode;

And determining the target abnormal time meeting the screening conditions from the abnormal time corresponding to the abnormal time of the at least one session data.

In one possible implementation manner, detecting the session data in the preset time period by adopting at least two anomaly detection modes, and respectively obtaining an anomaly time corresponding to at least one anomaly session data corresponding to each anomaly detection mode, where the method includes:

and respectively executing the following operations on the session data by adopting each abnormality detection mode:

detecting the session data to obtain a first abnormal score corresponding to each moment in the preset time period; the first anomaly score is used for representing the probability of overrun of the session number corresponding to any moment in a preset time period;

and screening a first candidate abnormal score meeting a first preset condition from the obtained plurality of first abnormal scores, and taking the moment corresponding to the first candidate abnormal score as the abnormal moment.

In one possible implementation manner, determining the target abnormal time meeting the screening condition from the abnormal times corresponding to the abnormal time of the at least one obtained session data includes:

Placing the abnormal time at the same time into a candidate abnormal time set to obtain at least one candidate abnormal time set;

And screening the candidate abnormal time set with the largest number of abnormal times from the at least one candidate abnormal time set, taking the candidate abnormal time set as a first candidate abnormal time set, and taking the abnormal time contained in the first candidate abnormal time set as a target abnormal time.

In one possible implementation, determining whether there is an overrun in the number of sessions according to the anomaly duration period includes:

The preset time period is subjected to equal ratio segmentation according to the time sequence, and a first sub-time period, a second sub-time period and an N-th sub-time period are sequentially obtained, wherein N is not less than 2;

If the abnormal duration time period in the m-th sub-time period is larger than the abnormal duration time period in the n-th sub-time period, determining that the number of sessions is over-limited, wherein m is larger than n.

Dividing the preset time period into a first sub-time period and a second sub-time period; the duration of the first sub-time period is the same as that of the second sub-time period, and the first sub-time period is earlier than the second sub-time period;

if the abnormal duration time period in the second sub-time period is larger than the abnormal duration time period in the first sub-time period, determining that the number of sessions is over-limited.

In one possible implementation manner, after acquiring the session data of the preset time period, the method further includes:

And carrying out normalization processing on the session data to obtain processed session data.

In one possible embodiment, the method further comprises:

If the number of the sessions exceeds the limit, a prompt message is sent, wherein the prompt message is used for prompting that the number of the sessions exceeds the limit.

In a second aspect, there is provided an apparatus for detecting overrun in a session number, the apparatus comprising:

the processing unit is used for receiving the conversation number overrun detection instruction and acquiring conversation data in a preset time period according to the conversation number overrun detection instruction;

The first detection unit is used for determining a target abnormal moment which accords with the screening condition according to the session data of the preset time period and determining a session number threshold according to the abnormal session number corresponding to the target abnormal moment; the screening condition is used for selecting the abnormal time with the highest confidence from the abnormal time corresponding to the abnormal session data in the preset time period;

A determining unit, configured to determine, according to the session number threshold, an abnormal duration period in which the number of sessions exceeds the session number threshold in the preset period;

and the second detection unit is used for determining whether the session number exceeds the limit according to the abnormal duration time period.

In a possible embodiment, the first detection unit is specifically configured to:

In a possible embodiment, the second detection unit is specifically configured to:

In a possible implementation manner, after acquiring the session data of the preset period, the processing unit is further configured to:

In a possible implementation manner, the device further comprises a prompting unit, configured to:

In a third aspect, a network device is provided, the network device comprising:

A memory for storing program instructions;

and a processor for calling program instructions stored in the memory, and executing steps comprised in any one of the methods of the first aspect according to the obtained program instructions.

In a fourth aspect, there is provided a storage medium storing computer-executable instructions for causing a network device to perform steps comprised by any one of the methods of the first aspect.

In a fifth aspect, there is provided a computer program product enabling a network device to carry out the steps comprised by any of the methods of the first aspect when said computer program product is run on the network device.

The technical scheme provided by the embodiment of the invention at least has the following beneficial effects:

When receiving the instruction for detecting the overrun of the number of the sessions, the network device automatically acquires session data in a preset time period according to the instruction for detecting the overrun of the number of the sessions. Then, the network equipment determines a target abnormal time meeting the screening conditions according to session data in a preset time period, and determines a session number threshold according to the abnormal session number corresponding to the target abnormal time. Obviously, in the embodiment of the invention, the abnormal time with the highest confidence is selected as the target abnormal time from the abnormal times determined by a plurality of methods, so that the more accurate target abnormal time can be obtained, and further the session number threshold with higher accuracy can be obtained.

Further, the network device may determine, according to the session number threshold, an abnormal duration period in which the session number exceeds the session number threshold in the preset period; and determining whether the session number exceeds the limit according to the abnormal duration time period. It can be seen that the network device can determine whether the number of sessions is overrun according to the comparison of different times of the abnormal duration period within the preset period, that is, by adopting a method of the same ratio. Therefore, based on the threshold value of the conversation number with higher accuracy, the abnormal duration time period is determined, and in combination with the transformation of the abnormal duration time period at different times, whether the conversation number exceeds the limit can be determined more accurately.

Additional features and advantages of the invention will be set forth in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. The objectives and other advantages of the invention will be realized and attained by the structure particularly pointed out in the written description and claims thereof as well as the appended drawings.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention as claimed.

Drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and together with the description, serve to explain the principles of the invention and do not constitute a undue limitation on the invention.

Fig. 1 is a schematic diagram of an application scenario in an embodiment of the present invention;

FIG. 2 is a flow chart of a method for detecting overrun of session number according to an embodiment of the present invention;

FIG. 3 is a flowchart of another method for detecting overrun of session number according to an embodiment of the present invention;

FIG. 4 is a block diagram of a device for detecting overrun of session number in an embodiment of the present invention;

Fig. 5 is a schematic structural diagram of a network device according to an embodiment of the present invention.

Detailed Description

For the purpose of making the objects, technical solutions and advantages of the present invention more apparent, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention, and it is apparent that the described embodiments are only some embodiments of the present invention, not all embodiments of the present invention. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention. Embodiments of the invention and features of the embodiments may be combined with one another arbitrarily without conflict. Also, while a logical order is depicted in the flowchart, in some cases, the steps depicted or described may be performed in a different order than presented herein.

The terms "first" and "second" in the description and claims of the invention and in the above-described figures are used for descriptive purposes only and are not to be construed as either explicit or implicit relative importance or order. Furthermore, the term "include" and any variations thereof is intended to cover non-exclusive protection. For example, a process, method, system, article, or apparatus that comprises a list of steps or elements is not limited to only those listed steps or elements but may include other steps or elements not listed or inherent to such process, method, article, or apparatus.

With the advent of the internet of things era, more and more devices are networked in the home, and the devices occupy a large amount of session number data, if the session number threshold set by a network operator is reached, network blocking can be caused, and the internet surfing experience of a user is affected. The prior art scheme mainly relies on the identification of abnormal sessions through algorithms such as manually setting session number thresholds or clustering. These approaches have the following limitations:

Currently, the existing method for detecting the overrun of the number of the sessions in the related art, for example, manually determines the threshold of the number of the sessions or adopts a clustering algorithm to determine the threshold of the number of the sessions, however, the threshold of the number of the sessions determined by adopting the existing method for detecting the overrun of the number of the sessions has poor accuracy, thereby causing poor accuracy for detecting the overrun of the number of the sessions.

In view of this, the invention provides a method for detecting the overrun of the conversation number, which adopts at least two high-efficiency unsupervised anomaly detection algorithms, comprehensively determines the anomaly time based on a voting method, and determines the conversation number threshold according to the conversation number corresponding to the anomaly time, namely, the conversation number threshold can be dynamically identified, and the conversation number threshold determined by adopting a plurality of anomaly detection algorithms is more accurate, so that the overrun of the conversation number can be more accurately detected.

After the design concept of the embodiment of the present invention is introduced, some simple descriptions are provided for application scenarios suitable for the technical solution in the embodiment of the present invention, and it should be noted that, the application scenarios described in the embodiment of the present invention are for more clearly describing the technical solution of the embodiment of the present invention, and do not constitute a limitation on the technical solution provided by the embodiment of the present invention, and as a new application scenario appears, those skilled in the art can know that the technical solution provided by the embodiment of the present invention is equally suitable for similar technical problems.

Referring to fig. 1, a schematic diagram of a scenario in which an embodiment of the invention may be applied includes a plurality of networking devices 101 and a network device 102, where fig. 1 illustrates that 3 networking devices (such as a networking device 101-1, a networking device 101-2, and a networking device 101-3) interact with one network device 102. In practical implementation, the number of the plurality of networking devices 101 may be 4, 16, etc., which is not limited in the embodiment of the present invention.

The networking device 101 and the network device 102 may be communicatively coupled via a network 103. The network 103 may be a wired network, or may be a wireless network, for example, a mobile cellular network, or may be a wireless Fidelity (WiFi) network, or may be other possible networks, which the embodiments of the present invention are not limited to.

The networking device 101 may be any networking device in the home, such as a portable network device like a mobile phone, a tablet computer, a notebook computer, etc., for example, the portable network device may be mountedOr other operating system. In addition, the networking equipment can also be wearing equipment such as a watch, a bracelet and the like; or may also be intelligent home devices such as televisions, refrigerators, etc., and in any case, the embodiments of the present invention are not limited to specific types of networking devices.

The network device 102 may be understood as a switch or gateway, wherein the switch or gateway connects to a broadband network provided by a network operator and the user connects to the switch or gateway via the networking device 101 to access the network. During interaction of the networked devices 101 via the internet, a session may be generated and transferred within the switch or gateway.

In order to further explain the scheme of the method for detecting the overrun of the session number provided by the embodiment of the invention, the following detailed description is given with reference to the accompanying drawings and the specific embodiments. Although embodiments of the present invention provide the method operational steps shown in the following embodiments or figures, more or fewer operational steps may be included in the method, either on a routine or non-inventive basis. In steps where there is logically no necessary causal relationship, the execution order of the steps is not limited to the execution order provided by the embodiments of the present invention. The methods may be performed sequentially or in parallel (e.g., parallel processor or multi-threaded processing application environments) as shown in the embodiments or figures when the methods are performed in the actual process or apparatus.

The method for detecting the overrun of the session number in the embodiment of the present invention is described below with reference to the flowchart of the method shown in fig. 2, and each step shown in fig. 2 may be performed by the network device shown in fig. 1.

Step 201: the network equipment receives the conversation number overrun detection instruction, and acquires conversation data in a preset time period according to the conversation number overrun detection instruction.

In the embodiment of the invention, the network equipment can receive the conversation number overrun detection instruction sent by the user through any networking equipment used by the network equipment. In one embodiment, the instruction of detecting the excessive number of sessions may be triggered by a user selecting a function key for detecting the excessive number of sessions in any networking device used by the user when the user finds that the network card is present in the networking device. In another embodiment, the instruction for detecting the overrun of the session number may be triggered by the user executing a corresponding touch or click operation in an option appearing in a network diagnosis interface of any networking device used by the user when the user finds that the network card appears in the networking device. In an embodiment, besides the touch or click operation, the touch or click operation may be a long-press operation, a gravity press operation, a sliding operation, etc., which is not limited to the specific implementation form of the operation according to the embodiment of the present invention.

In the embodiment of the invention, after the network equipment receives the conversation number overrun detection instruction, conversation data in a preset time period can be obtained according to the conversation number overrun detection instruction. Optionally, the preset time period is, for example, 14 days before the moment of receiving the instruction of detecting the overrun of the number of sessions, or a month before the moment of receiving the instruction of detecting the overrun of the number of sessions, which is not limited in the embodiment of the present invention. The network device may obtain the number of sessions within the network device at each time within a preset period of time.

In the embodiment of the present invention, after the network device obtains the session data of the preset period, the session data may be processed according to the following step 202.

Step 202: the network equipment determines a target abnormal time meeting the screening conditions according to session data in a preset time period, and determines a session number threshold according to the abnormal session number corresponding to the target abnormal time; the screening condition is used for selecting the abnormal time with the highest confidence from abnormal times corresponding to abnormal session data in a preset time period.

In the embodiment of the invention, the network equipment adopts at least two abnormality detection modes to detect the session data in a preset time period, and the abnormal moment corresponding to at least one abnormal session data corresponding to each abnormality detection mode is respectively obtained. Then, the network equipment determines a target abnormal moment which meets the screening condition from the abnormal moment corresponding to the abnormal moment of at least one obtained session data.

In the embodiment of the invention, each of at least two abnormality detection modes adopts an unsupervised learning mode to detect session data in a preset time period. The non-supervision learning mode is that the electronic device does not need to obtain the data with marked categories, but autonomously analyzes and searches for features or rules existing in the session data in a preset time period, for example, since the abnormal type with the overrun session number is boundary type abnormal, namely, abnormal points can be completely separated only when an explicit decision boundary exists, and therefore, the decision boundary can be analyzed and searched through the non-supervision learning mode. Due to the rare characteristic of abnormal values in session data, professional operation and maintenance personnel are required to carry out manual labeling in the related technology, and the human resource cost is increased. The non-supervision learning mode adopted in the embodiment of the invention does not need professional operation and maintenance personnel to carry out manual marking, reduces the cost of human resources, and can improve the detection efficiency because the manual marking is not needed.

In the embodiment of the invention, the network equipment can determine at least two abnormal detection modes for detecting the session data. Each of the at least two anomaly detection modes may be implemented based on one anomaly detection algorithm, that is, the network device may determine at least two anomaly detection algorithms for detecting session data. Optionally, the at least two anomaly detection algorithms include at least two of a cluster-based local anomaly factor identification (English: cluster-based local outlier factor, abbreviation: CBLOF) anomaly detection algorithm, a box-plot anomaly detection algorithm, an isolated forest (English: isolation forest, abbreviation: iForest) anomaly detection algorithm, a k-nearest neighbor (K nearest neighbors) anomaly detection algorithm, a minimum covariance determinant (English: minimum covariance determinan, abbreviation: MCD) anomaly detection algorithm, and a class of support vector machine (English: one-class support vector machine, abbreviation: OCSVM) anomaly detection algorithms.

Before describing a method for detecting session data, the following first describes an anomaly detection algorithm provided in the embodiment of the present invention.

First anomaly detection algorithm: CBLOF anomaly detection algorithm.

The first step in CBLOF anomaly detection algorithms is clustering, for example using the k-means algorithm. Alternatively, size clusters are distinguished according to 2 principles: absolute logarithmic principle and dip principle. The absolute logarithmic principle is to arrange the clusters according to the number of samples in the clusters from large to small, and sequentially add up the number of samples in the clusters from the largest cluster, wherein the number of the large clusters reaches the absolute majority of the total number of samples; the absolute majority is a parameter alpha which can be set, and the value range is 0.5 to 1; the dip principle refers to whether the number of cluster samples arranged according to the size drops suddenly, and if so, the cluster samples are boundaries of the size clusters.

The second step in the CBLOF anomaly detection algorithm is to calculate the LOF factor, i.e., the distance from a point in time to the nearest cluster. If the moment point is a moment point in a large cluster, calculating the distance from the moment point to the center of the cluster to obtain an LOF factor; if the time point is not a large cluster point, the distances from the time point to all the large clusters are calculated respectively, and the minimum distance is selected as the LOF factor.

Adopting a first anomaly detection algorithm, if the LOF factor corresponding to a moment is smaller, determining that the probability of being a normal moment is higher when the moment is closer to a large cluster; if the LOF factor corresponding to a moment point is larger, the probability of being an abnormal moment point is higher when the moment point is far away from a large cluster. Thus, the first anomaly score of one time point can be correspondingly determined according to the magnitude of the LOF factor corresponding to the one time point and the corresponding relation between the LOF factor and the anomaly score.

A second anomaly detection algorithm: and (5) a box diagram abnormality detection algorithm.

The box plot is primarily used to reflect the central location and spread of one or more sets of continuous quantitative data distributions, the box plot being a graphical depiction formed by the quartiles of the data set. The upper and lower beards are boundaries of the data distribution, and the data points higher than the upper beards or lower than the lower beards are considered as outliers or outliers.

Wherein, the lower quartile represents the value corresponding to 25% of the quantiles (e.g. represented by Q1), the upper quartile represents the value corresponding to 75% of the quantiles (e.g. represented by Q3), the upper quartile represents Q3+1.5 (Q3-Q1), and the lower quartile represents Q1-1.5 (Q3-Q1).

If the second anomaly detection algorithm is adopted, considering that all the time points with the overrun conversation number are the time points with the abnormally high conversation number, the first anomaly score of the moment point can be determined according to the fact that the conversation data corresponding to the moment point are higher than the upper whisker value and the corresponding relation between the preset higher-whisker value and the anomaly score.

Third anomaly detection algorithm: iForest anomaly detection algorithm.

The iForest algorithm, like the random forest, consists of a large number of decision trees, iForest consists of a large number of binary trees, and is a completely random process. Assuming that the data set has N pieces of time data, when a binary tree is constructed, N samples are uniformly sampled from the N pieces of data to be used as training samples of the binary tree. Wherein N and N are positive integers, and N is greater than N. And randomly selecting a feature in the training sample, randomly selecting a value in all value ranges (such as between a minimum value and a maximum value) of the feature, carrying out binary division on the training sample, and dividing the value smaller than the value in the training sample to the left of a node and the value larger than or equal to the value to the right of the node. And then repeating the above processes on the left and right data sets respectively until the data set has only one record or reaches the limit height of the binary tree, and taking the abnormal moment data corresponding to the record as a root.

It is considered that the abnormal time data is small and the characteristic value and the normal data are greatly different. Thus, when constructing a binary tree, the outlier data is closer to the root and the normal data is farther from the root. The result of one binary tree is often unreliable, and iForest anomaly detection algorithm constructs a plurality of binary trees through multiple sampling. And finally integrating the results of all the trees, taking the average depth as a final root, and calculating a first anomaly score at the anomaly time according to the distance between the data at each time and the root.

Fourth anomaly detection algorithm: k-neighbor anomaly detection algorithm.

The algorithm of k-nearest neighbor is that if one sample point is most similar to k sample points in the dataset and most of the k sample points belong to a certain class, then that sample point also belongs to a certain class.

The k-nearest neighbor anomaly detection algorithm mainly comprises three steps, wherein the first step is to calculate the distance between the current point and each sample point in the data set according to each sample point in the data set, and the Euclidean distance is used for measuring the common distance Calculating, wherein x ₂ is used for representing the number of sessions at time 2, and x ₁ is used for representing the number of sessions at time 1, wherein time 1 is earlier than time 2; the second step is to sort all the obtained distances from small to large, wherein the smaller the distances are, the more similar the distances are; and thirdly, taking the average value of the distances of the previous k sample points as a first abnormal score of the current point.

The k-nearest neighbor algorithm has the advantages of short training time, no assumption on data and high accuracy in detecting abnormal values of time sequence data.

Fifth anomaly detection algorithm: MCD anomaly detection algorithm.

Considering an n-row p-column matrix X _n×p, h sample points are randomly extracted from it, and the sample mean T ₁ and covariance matrix S ₁ of the h sample points are calculated. Then pass throughWherein x is used for representing the number of sessions, the mahalanobis distance from the n sample points to the sample mean value T ₁ is calculated, the smallest h sample points in the n distances are selected, and then the sample mean value T ₂ and the covariance matrix S ₂ are calculated through the h sample points. At this point det may be determined (S ₂)≤det(S₁), if and only if T ₁＝T₂,S₁＝S₂, the equal sign holds. This continues the iteration, stopping the iteration when det (S _m)＝det(S_m-1). Then, the weighted calculation is performed through S _m, so that the covariance matrix estimated value can be obtained as the abnormal time.

For example, if the fifth anomaly detection algorithm is graphically represented, it can be understood that the ultra-ellipsoid containing h sample points with the shortest distance to the center of the sample is continuously found, i.e., the remaining n-h sample points are excluded from the ultra-ellipsoid. Namely, the first abnormal score is correspondingly determined according to the length of the distance from the center of the sample, which comprises h sample points.

Sixth anomaly detection algorithm: OCSVM anomaly detection algorithm.

The core idea of the OCSVM algorithm is to find a hyperplane to circle out the positive examples in the samples, and make a decision on the samples through the hyperplane, so that the samples in the circle are considered as positive samples. Assuming that the generated hypersphere parameters are the center o, which is a supported linear combination, and the corresponding hypersphere radius r >0, the hypersphere volume V (r) is minimized; similar to the conventional SVM method, all training data points x_i may be required to be exactly less than r from center. But simultaneously constructs a relaxation variable ζ_i with a penalty factor C, the optimization problem is as follows:

‖x_i-o‖₂≤r+ξ_i,i＝1,2,3,…,m

ξ_i≥0,i＝1,2,…,m

After the lagrangian dual solution is adopted, whether a new sample point z is included or not can be judged, if the distance from z to the center is smaller than or equal to the radius r, the new sample point z is not an abnormal point, and if the new sample point z is out of the hypersphere, the new sample point z can be considered as a candidate abnormal point. Further, according to the distance of the new sample point z outside the hypersphere, the corresponding relation between the preset distance value and the abnormal score can be combined to determine the first abnormal score corresponding to the new sample point.

In the embodiment of the present invention, the network device may detect the session data by adopting at least two anomaly detection algorithms of the six anomaly detection algorithms. In an embodiment, the electronic device may employ CBLOF an anomaly detection algorithm and a box-line graph anomaly detection algorithm to detect the session data. In another embodiment, the network device may further detect session data using iForest anomaly detection algorithm, k-neighbor anomaly detection algorithm, and MCD anomaly detection algorithm. In another embodiment, the network device may further detect session data by adopting CBLOF anomaly detection algorithm, box diagram anomaly detection algorithm, iForest anomaly detection algorithm, k-neighbor anomaly detection algorithm, MCD anomaly detection algorithm, and ocvm anomaly detection algorithm, where the types and specific numbers of the anomaly detection algorithms adopted in the embodiment of the present invention are not limited.

In the following, the network device uses CBLOF anomaly detection algorithm, box diagram anomaly detection algorithm, iForest anomaly detection algorithm, k-nearest neighbor anomaly detection algorithm, MCD anomaly detection algorithm, and OCSVM anomaly detection algorithm to detect session data as an example, and how to detect session data is described.

In the embodiment of the present invention, the network device may use each of the six anomaly detection algorithms to perform the following operations on session data:

Step A: detecting session data to obtain a first abnormal score corresponding to each moment in a preset time period; the first anomaly score is used for representing the probability of overrun of the session number corresponding to any moment in a preset time period;

and (B) step (B): and screening first candidate abnormal scores meeting a first preset condition from the obtained plurality of first abnormal scores, and taking the moment corresponding to the first candidate abnormal scores as the abnormal moment.

In a possible embodiment, after performing the obtaining of the session data for the preset period, the network device may further perform normalization processing on the session data to obtain processed data. Since the processed data is in a fixed range, i.e. the number of sessions in a preset time period is adjusted to be between one order of magnitude, a good implementation basis is provided for subsequent processing.

Accordingly, the anomaly detection algorithm may perform the following steps after adjustment on the processed session data:

Step a: detecting the processed data to obtain a first abnormal score corresponding to each moment in a preset time period; the first anomaly score is used for representing the probability of overrun of the session number corresponding to any moment in a preset time period;

Step b: and screening first candidate abnormal scores meeting a first preset condition from the obtained plurality of first abnormal scores, and taking the moment corresponding to the first candidate abnormal scores as the abnormal moment. Thus, a more accurate abnormal time can be obtained.

Optionally, the first preset conditions corresponding to each abnormality detection mode may be the same or different, and may specifically be set correspondingly according to actual implementation, which is not limited in the embodiment of the present invention. The first preset condition is that the first abnormality score is greater than a preset threshold, and the preset threshold is correspondingly determined according to an adopted abnormality detection mode.

In the embodiment of the present invention, the specific process of the network device for processing the session data or the session data after processing by using the six anomaly detection algorithms may refer to the specific description of the six anomaly detection algorithms, which is not described herein in detail. Thus, the network device can obtain the first anomaly scores corresponding to the six anomaly detection algorithms respectively.

For example, the first anomaly score for each time in 14 days corresponding to the first anomaly detection algorithm, the first anomaly score for each time in 14 days corresponding to the second anomaly detection algorithm, the first anomaly score for each time in 14 days corresponding to the third anomaly detection algorithm, the first anomaly score for each time in 14 days corresponding to the fourth anomaly detection algorithm, the first anomaly score for each time in 14 days corresponding to the fifth anomaly detection algorithm, and the first anomaly score for each time in 14 days corresponding to the sixth anomaly detection algorithm.

After the network device obtains the first anomaly scores corresponding to the six anomaly detection algorithms respectively, the first preset conditions corresponding to the six anomaly detection algorithms can be determined respectively. In one embodiment, the first preset condition may be understood as screening the first abnormal score for an average score greater than a preset time period, as the first candidate abnormal score. In another embodiment, the first preset condition may be understood as screening the first M highest abnormal scores, where M is a positive integer. Of course, the first preset condition may be other conditions, which is not limited in the embodiment of the present invention. The first preset conditions corresponding to each anomaly detection algorithm may be the same or different, which is not limited in the embodiment of the present invention.

After the network device determines the first preset conditions respectively corresponding to the six abnormality detection algorithms, at least one abnormality time respectively corresponding to the six abnormality detection algorithms can be screened out based on the first preset conditions. Further, after the network device determines at least one anomaly time corresponding to each of the six anomaly detection algorithms, a target anomaly time may be determined.

In the embodiment of the invention, the network equipment can put the abnormal time at the same time into a candidate abnormal time set from at least one abnormal time corresponding to at least two abnormal detection algorithms respectively to obtain at least one candidate abnormal time set; screening a candidate abnormal time set with the largest number of abnormal times from at least one candidate abnormal time set, taking the candidate abnormal time set as a first candidate abnormal time set, and taking the abnormal time contained in the first candidate abnormal time set as a target abnormal time.

Optionally, the network device may screen out at least one anomaly time corresponding to each of the six anomaly detection algorithms from at least one anomaly time corresponding to each of the six anomaly detection algorithms, and place the anomaly time at the same time into a candidate anomaly time set to obtain at least one candidate anomaly time set; screening a candidate abnormal time set with the largest number of abnormal times from at least one candidate abnormal time set, taking the candidate abnormal time set as a first candidate abnormal time set, and taking the abnormal time contained in the first candidate abnormal time set as a target abnormal time.

For example, the at least one abnormality time corresponding to the first abnormality detection includes 3 points 05 minutes on day 5 and 12 points 30 minutes on day 7; at least one abnormal moment corresponding to the second abnormal detection comprises 3 points 05 minutes on the 5 th day and 12 points 30 minutes on the 4 th day; at least one abnormal moment corresponding to the third abnormal detection comprises 3 points 05 minutes on the 5 th day and 1 point 30 minutes on the 1 st day; at least one abnormal moment corresponding to the fourth abnormal detection comprises 12 points of 20 minutes on the 4 th day; at least one abnormal moment corresponding to the fifth abnormal detection comprises 11 points 30 minutes of the 7 th day; and, if the sixth abnormality detection corresponds to at least one abnormality time including 3 points 05 minutes on day 5, 12 points 30 minutes on day 6, and 1 point 30 minutes on day 1, two sets of candidate abnormality times can be determined, each set being a set of candidate abnormality times including 3 points 05 minutes on day 5 and 2 sets of candidate abnormality times including 1 point 30 minutes on day 1, whereby it can be determined that the set of candidate abnormality times including 3 points 05 minutes on day 5 is the first set of candidate abnormality times, and further it can be determined that the target abnormality time is 3 points 04 minutes on day 5. That is, the abnormal time point of 3 point 04 on the 5 th day is voted by three algorithms among the six algorithms, that is, the abnormal time point of 3 point 04 on the 5 th day is determined as the abnormal time point of 3 point 04 on the 5 th day if the confidence is highest.

In the embodiment of the invention, after the target abnormal time is determined, the abnormal session number corresponding to the target abnormal time can be used as the session number threshold. For example, 50 abnormal sessions, which are 3 points of 05 minutes on day 5, are used as the session number threshold.

Therefore, in the embodiment of the invention, according to the historical data of the conversation number, a plurality of efficient anomaly detection algorithms are adopted, the target anomaly time is selected based on a voting method, and the conversation number at the target anomaly time is used as the conversation number threshold value, so that the threshold value of the conversation number is dynamically identified.

Step 203: and the network equipment determines an abnormal duration time period of which the session number exceeds the session number threshold value in a preset time period according to the session number threshold value.

In the embodiment of the invention, after the network device obtains the session number threshold, the network device can determine an abnormal duration time period when the session number exceeds the session number threshold in a preset time period according to the session number threshold.

In an embodiment, the network device may determine the duration of the anomaly in the number of sessions per day for a preset period of time according to the threshold number of sessions. Optionally, because the abnormal duration of the shorter session number generally does not affect the internet surfing experience of the user, the situation that the duration is smaller than the preset value can be eliminated, wherein the preset value can be 10 minutes, 5 minutes, etc., and the embodiment of the invention is not limited to this.

Step 204: and determining whether the session number exceeds the limit according to the abnormal duration time period.

In the embodiment of the invention, considering that the moment of higher session number does not completely represent the overrun of session number, the user opens peer-to-peer (P2P) application, connects more terminals and other operations to cause the increase of session number, but these increased conditions do not necessarily reach the session number threshold set by the network operator, thereby causing network blocking. And, the increase of the session number can cause network blocking to affect the internet surfing experience of the user, so that the user can use the function of detecting the abnormal overrun of the session number to perform network obstacle removal.

The embodiment of the invention provides a method adopting the same ratio, and after a user operates the function of detecting the abnormal number of sessions, the method compares the duration trend of the abnormal number of sessions in a sub-time period in a preset time period and determines whether the abnormal number of sessions is out of limit.

In one possible implementation manner, the network device performs equal ratio segmentation on a preset time period according to time sequence, and sequentially obtains a first sub-time period, a second sub-time period and an N sub-time period, wherein N is not less than 2; if the abnormal duration time period in the mth subtime period is larger than the abnormal duration time period in the nth subtime period, determining that the number of sessions is over-limited, wherein m is larger than n. Wherein N, m, N are positive integers. The proportion of the equal ratio cutting is correspondingly determined based on actual implementation, and the equal ratio cutting is not limited in the embodiment of the invention.

Alternatively, when the abnormal time period in the m-th sub-time period and the abnormal time period in the n-th sub-time period are compared, the abnormal time periods of each day in the two sub-time periods may be compared, or the longest abnormal time period of each day in the two sub-time periods may be compared, or of course, only the specific abnormal time period may be compared, which is not limited in the embodiment of the present invention.

In an embodiment, assuming that the preset time period is 8 days (from 3 months 1 to 3 months 8), the 8 days are equally divided into four sub-time periods, for example, 3 months 1 to 3 months 2 as the first sub-time period, 3 months 3 to 3 months 4 as the second sub-time period, 3 months 5 to 3 months 6 as the third sub-time period, and 3 months 7 to 3 months 8 as the fourth word time period, the network device may determine that the four sub-time periods are abnormal for the longest duration of the daily session number.

Alternatively, if the abnormal duration in the second sub-period is greater than the abnormal duration in the first sub-period, this indicates that the number of sessions is overrun, otherwise, it is not present, and this network failure is caused by other reasons.

Alternatively, if the abnormal duration in the fourth sub-period is greater than the abnormal duration in the third sub-period, it indicates that there is an overrun in the number of sessions.

Optionally, if the abnormal duration in the second sub-period is equal to the abnormal duration in the first sub-period, and the abnormal duration in the third sub-period is equal to the abnormal duration in the second sub-period, but the abnormal duration in the fourth sub-period is greater than the abnormal duration in the first sub-period, it indicates that there is an overrun condition of the session number, otherwise, it does not exist, and the network failure is caused by other reasons.

Optionally, if the abnormal duration in the second sub-period is equal to the abnormal duration in the first sub-period, and the abnormal duration in the third sub-period is smaller than the abnormal duration in the second sub-period, but the abnormal duration in the fourth sub-period is larger than the abnormal duration in the third sub-period, it indicates that the situation that the number of sessions is over-limited, otherwise, it does not exist, and the network fault is caused by other reasons.

It can be seen that, in the embodiment of the present invention, as long as the abnormal duration period in the next sub-period occurs, which is greater than the abnormal duration period in the previous sub-period of the next sub-period, the number of sessions is considered to be over-limited.

In one possible implementation, the network device may divide the preset time period into a first sub-time period and a second sub-time period; the first sub-time period and the second sub-time period have the same duration, and the first sub-time period is earlier than the second sub-time period; if the abnormal duration time period in the second sub-time period is larger than the abnormal duration time period in the first sub-time period, determining that the number of sessions is over-limited; if the abnormal duration time period in the second sub-time period is smaller than the abnormal duration time period in the first sub-time period, determining that the session number overrun does not exist.

Alternatively, when the abnormal time period in the second sub-time period and the abnormal time period in the first sub-time period are compared, the abnormal time periods each day in the two sub-time periods may be compared, or the longest abnormal time period each day in the two sub-time periods may be compared, or of course, only the specific abnormal time period may be compared, which is not limited in the embodiment of the present invention.

In an embodiment, assuming that the preset time period is 14 days, the 14 days are divided into two sub-time periods, for example, the first 7 days are taken as a first sub-time period, the last 7 days are taken as a second sub-time period, the network device can determine the abnormal longest duration of the daily session number of the first 7 days and the abnormal longest duration of the daily session number of the last 7 days, if the abnormal duration of the daily session number of the first 7 days finds a significant rising trend in the last 7 days, this indicates that the condition of the session number exceeding the limit exists, otherwise, this network failure is caused by other reasons.

In another embodiment, assuming that the preset time period is 14 days, the 14 days are divided into two sub-time periods, for example, the first 7 days are taken as a first sub-time period, the last 7 days are taken as a second sub-time period, the network device can determine the abnormal duration of the daily session number of the first 7 days and the abnormal duration of the daily session number of the last 7 days, if the abnormal duration of the last 7 days is greater than the abnormal duration of the first 7 days, the condition that the session number is over-limit is indicated, otherwise, the condition does not exist, and the network fault is caused by other reasons.

In one possible implementation, if the network device determines that the number of sessions is out of limit, a prompt message is sent, where the prompt message is used to prompt that the number of sessions is out of limit. The network device can inform the user of the detection result of the overrun of the session number, and then the user can end the application occupying the higher session number or increase the bandwidth by reducing the networking device, so as to relieve the network fault.

In one possible embodiment, if it is determined that the abnormal time period in the previous sub-time period of the current sub-time period is equal to the abnormal time period in the current sub-time period, another prompt message is sent to the user, where the prompt message is used to prompt the user that there may be a network failure.

In order to more clearly describe the method for detecting the overrun of the session number provided by the embodiment of the present invention, a specific example is described below, and please refer to fig. 3.

Step 301: receiving a conversation number overrun detection instruction, and acquiring conversation data in a preset time period according to the conversation number overrun detection instruction.

In the embodiment of the present invention, step 301 may be performed with reference to the foregoing specific implementation of step 201, which is not described herein.

Step 302: and carrying out normalization processing on the session data to obtain processed session data.

Step 303: and respectively detecting the processed session data by adopting six abnormal detection algorithms, and respectively obtaining abnormal moments corresponding to at least one abnormal session data.

The specific manner of detecting the processed session data by the six anomaly detection algorithms may refer to the foregoing description of the six anomaly detection algorithms, which is not repeated herein.

Step 304: and determining a target abnormal time from the abnormal times corresponding to the at least one abnormal session data respectively obtained by adopting a voting method, and taking the abnormal session number corresponding to the target abnormal time as a session number threshold.

Alternatively, the voting method may be understood as the aforementioned processing manner of screening the candidate abnormal time set.

In an embodiment, if at least one of the abnormality times respectively corresponding to the six abnormality detection algorithms includes the same abnormality time (for example, 18 points on day 3 are 30 minutes), it is determined that the three abnormality detection algorithms cast the same abnormality time ticket, and the abnormality time may be regarded as the target abnormality time.

In another embodiment, if at least one of the abnormality times respectively corresponding to the six abnormality detection algorithms includes the same abnormality time (for example, 30 minutes at 6 th day), it is determined that the six abnormality detection algorithms cast one ticket for the same abnormality time, and the abnormality time with the highest confidence, which is the highest voting among all the abnormality times, may be regarded as the target abnormality time.

Step 305: and determining an abnormal duration time period when the number of the sessions exceeds the session number threshold value in the preset time period according to the session number threshold value.

In the embodiment of the present invention, step 305 may be performed with reference to the foregoing specific implementation of step 203, which is not described herein.

Step 306: determining whether the rate of increase of the abnormal duration period is greater than a threshold, if so, executing step 307; if the rate of increase of the anomaly duration period is less than the threshold, step 308 is performed.

Alternatively, the method of determining the rate of increase of the abnormal duration period may be performed with reference to the specific embodiment of step 204, which is not described herein. The threshold may be determined according to an actual implementation, which is not limited in the embodiment of the present invention.

For example, the preset time period is divided into a first sub-time period and a second sub-time period; the first sub-time period and the second sub-time period have the same duration, and the first sub-time period is earlier than the second sub-time period; the corresponding growth rate may be determined according to a difference between the abnormal duration period in the second sub-period and the abnormal duration period in the first sub-period, and whether the session number overrun exists may be determined according to a relationship between the growth rate and the threshold.

Step 307: it is determined that there is an overrun in the number of sessions.

Step 308: it is determined that there is no overrun in the number of sessions.

Therefore, the method for detecting the overrun of the conversation number provided by the embodiment of the invention can automatically collect the conversation number data of the user, mine the data characteristics, efficiently and accurately detect the time point of the anomaly of the conversation number through a plurality of anomaly detection algorithms, compare the longest duration of the anomaly of the conversation number every day through a comparison method, and identify the anomaly of the overrun of the conversation number if the time point of the anomaly duration of the conversation number is found. When the network is intelligently operated and maintained, the user can be helped to locate the fault cause of network blocking, and the operation and maintenance efficiency is improved. In addition, the method has the characteristics of high recognition accuracy, low realization complexity and short recognition time.

Based on the same inventive concept, the embodiment of the invention provides a device for detecting the overrun of the conversation number, which can realize the functions corresponding to the method for detecting the overrun of the conversation number. The means for detecting the overrun of the number of sessions may be a hardware structure, a software module, or a hardware structure plus a software module. The device for detecting the overrun of the conversation number can be realized by a chip system, and the chip system can be formed by a chip or can comprise the chip and other discrete devices. Referring to fig. 4, the device for detecting the overrun of the session number includes:

A processing unit 401, configured to receive a session number overrun detection instruction, and obtain session data in a preset time period according to the session number overrun detection instruction;

A first detecting unit 402, configured to determine, according to session data in the preset time period, a target abnormal time that meets a screening condition, and determine, according to the number of abnormal sessions corresponding to the target abnormal time, a session number threshold; the screening condition is used for selecting the abnormal time with the highest confidence from the abnormal time corresponding to the abnormal session data in the preset time period;

a determining unit 403, configured to determine, according to the session number threshold, an abnormal duration period in which the number of sessions exceeds the session number threshold in the preset period;

a second detecting unit 404, configured to determine whether the session number exceeds the limit according to the abnormal duration period.

In a possible implementation manner, the first detection unit 402 is specifically configured to:

In a possible implementation manner, the second detection unit 404 is specifically configured to:

In a possible implementation manner, after acquiring the session data of the preset period, the processing unit 401 is further configured to:

All relevant contents of each step related to the foregoing embodiment of the method for detecting the excessive number of sessions may be cited to the functional description of the functional module corresponding to the device for detecting the excessive number of sessions in the embodiment of the present invention, which is not described herein.

The division of the modules in the embodiments of the present invention is schematically only one logic function division, and there may be another division manner in actual implementation, and in addition, each functional module in each embodiment of the present invention may be integrated in one controller, or may exist separately and physically, or two or more modules may be integrated in one module. The integrated modules may be implemented in hardware or in software functional modules.

Based on the same inventive concept, an embodiment of the present invention provides a network device, please refer to fig. 5, which includes at least one processor 501 and a memory 502 connected to the at least one processor, in the embodiment of the present invention, a specific connection medium between the processor 501 and the memory 502 is not limited, in fig. 5, a connection between the processor 501 and the memory 502 is taken as an example, and the bus 500 is shown in a thick line in fig. 5, and a connection manner between other components is only illustrative and not limited. Bus 500 may be divided into an address bus, a data bus, a control bus, etc., and is represented by only one thick line in fig. 5 for ease of illustration, but does not represent only one bus or one type of bus. The device for detecting the overrun of the session number further comprises a communication interface 503 for receiving or transmitting data.

In the embodiment of the present invention, the memory 502 stores instructions executable by the at least one processor 501, and the at least one processor 501 may execute the steps included in the method for detecting the overrun of the session number by executing the instructions stored in the memory 502.

The processor 501 is a control center of the network device, and may use various interfaces and lines to connect various parts of the entire network device, and by executing or executing instructions stored in the memory 502 and invoking data stored in the memory 502, various functions of the network device and processing data, so as to monitor the network device as a whole.

Alternatively, the processor 501 may include one or more processing units, and the processor 501 may integrate an application processor and a modem processor, wherein the application processor primarily processes operating systems, user interfaces, application programs, etc., and the modem processor primarily processes wireless communications. It will be appreciated that the modem processor described above may not be integrated into the processor 501. In some embodiments, processor 501 and memory 502 may be implemented on the same chip, or they may be implemented separately on separate chips in some embodiments.

The processor 501 may be a general purpose processor such as a Central Processing Unit (CPU), digital signal processor, application specific integrated circuit, field programmable gate array or other programmable logic device, discrete gate or transistor logic device, discrete hardware components, and may implement or perform the methods, steps and logic blocks disclosed in embodiments of the present invention. The general purpose processor may be a microprocessor or any conventional processor or the like. The steps of a method disclosed in connection with the embodiments of the present invention may be embodied directly in a hardware processor for execution, or in a combination of hardware and software modules in the processor for execution.

The memory 502, as a non-volatile computer readable storage medium, may be used to store non-volatile software programs, non-volatile computer executable programs, and modules. The Memory 502 may include at least one type of storage medium, and may include, for example, flash Memory, a hard disk, a multimedia card, a card-type Memory, random access Memory (english: random Access Memory, abbreviated: RAM), static random access Memory (english: static Random Access Memory, abbreviated: SRAM), programmable Read-Only Memory (english: programmable Read Only Memory, abbreviated: PROM), read-Only Memory (english: ROM), charged erasable programmable Read-Only Memory (english: ELECTRICALLY ERASABLE PROGRAMMABLE READ-Only Memory, abbreviated: EEPROM), magnetic Memory, magnetic disk, optical disk, and the like. Memory 502 is any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer, but is not limited to such. The memory 502 in embodiments of the present invention may also be circuitry or any other device capable of performing storage functions for storing program instructions and/or data.

By programming the processor 501, the code corresponding to the method for detecting the excessive number of sessions described in the foregoing embodiment may be cured into the chip, so that the chip can execute the steps of the foregoing method for detecting the excessive number of sessions during operation, and how to program the processor 501 is a technology known to those skilled in the art will not be repeated here.

Based on the same inventive concept, the embodiments of the present invention also provide a storage medium storing computer instructions that, when run on a computer, cause the computer to perform the steps of the method of session number overrun detection as described above.

In some possible embodiments, aspects of the method of detecting excessive number of sessions provided by the present invention may also be implemented in the form of a program product comprising program code for causing a controlling network device to perform the steps in the method of detecting excessive number of sessions according to the various exemplary embodiments of the present invention described above in the present specification, when the program product is run on the controlling network device.

It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, magnetic disk storage, optical storage, and the like) having computer-usable program code embodied therein.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

It will be apparent to those skilled in the art that various modifications and variations can be made to the present invention without departing from the spirit or scope of the invention. Thus, it is intended that the present invention also include such modifications and alterations insofar as they come within the scope of the appended claims or the equivalents thereof.

Claims

1. A method for detecting overrun in a session number, the method comprising:

2. The method of claim 1, wherein determining a target anomaly time that meets a screening condition based on session data for the preset time period comprises:

3. The method of claim 2, wherein detecting the session data in the preset time period by using at least two anomaly detection modes, respectively obtaining an anomaly time corresponding to at least one anomaly session data corresponding to each anomaly detection mode, includes:

4. The method of claim 3, wherein determining a target abnormal time meeting the screening condition from abnormal times corresponding to abnormal times when the obtained at least one session data is abnormal, comprises:

5. The method of any of claims 1-4, wherein determining whether there is an overrun in the number of sessions based on the anomaly duration period comprises:

6. The method of claim 5, wherein determining whether there is an overrun in the number of sessions based on the anomaly duration period comprises:

7. The method according to any one of claims 1-4, wherein after acquiring session data for a preset period of time, the method further comprises:

8. An apparatus for detecting overrun in a session number, the apparatus comprising:

9. A network device, the network device comprising: memory, a processor and a computer program stored on the memory and executable on the processor, which when executed by the processor, performs the steps of the method of detecting an overrun in a session number as claimed in any one of claims 1 to 7.

10. A computer readable storage medium, characterized in that the computer readable storage medium has stored thereon a computer program which, when executed by a processor, implements the steps of the method of detecting an overrun in a session number according to any one of claims 1 to 7.